—Go
GO-2026-5670· CVE-2026-28736, GHSA-vph7-r229-qxpfFocalboard doesn't validate file ownership when serving uploaded files in github.com/mattermost/focalboard
Modified: 6/25/2026
package
Go/github.com/mattermost/focalboard
pkg:go/github.com/mattermost/focalboard
HIGH8.1Go
GHSA-p32q-v29x-wq9r· CVE-2026-25773, GO-2026-5524Focalboard doesn't sanitize category IDs before incorporating them into dynamic SQL statements
Modified: 6/25/2026
MEDIUM4.3Go
GHSA-vph7-r229-qxpf· CVE-2026-28736, GO-2026-5670Focalboard doesn't validate file ownership when serving uploaded files
Modified: 6/25/2026
—Go
GO-2026-5524· CVE-2026-25773, GHSA-p32q-v29x-wq9rFocalboard doesn't sanitize category IDs before incorporating them into dynamic SQL statements in github.com/mattermost/focalboard
Modified: 6/25/2026